Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwordless: a different kind of hell?

jcarlosroldan.com

Post reply on HN
Print view View original

161–170 of 392 posts

Re: Passwordless: a different kind of hell?

#161

Post by organsnyder »

filleokus wrote: post #4

I think the industry, to some extent, already have reconsidered the session length, see [0] by Auth0 for example (even if it's obv. a PR piece). Nowadays my gut assumption when I use a service with really short sessions is that their security practices are probably questionable. I recently argued, as the cybersecurity guy™, with a vendor that we can't ask regular users to reauthenticate every 15 minutes. They insiste…

Some of it depends on regulations and usage context. When I worked in healthcare, sessions were always short-lived. This may have been regulation-driven, but it's also based on the fact that often this software is being used on shared machines or in areas where unauthorized users are present (such as in patient rooms). While users are trained (very well, in my experience) to lock machines whenever they're unattended, short session lengths provide an additional layer of protection.

Re: Passwordless: a different kind of hell?

#162

Post by hot_gril »

waynesonfire wrote: post #134
graemep wrote: post #128

Earlier quoted context omitted.

There are things you can do to make it easier. My phone sends all notifications to my desktop, and I have an app on the phone that creates a notification when it recognises a code in the SMS, so all I need do is double click on the notification (to select the entire "word" that is the code) then paste into the site I am verifying to. There are also authenticator browser extensions so you do not have to use a phone ap…

> My phone sends all notifications to my desktop Is this a native phone feature or an app? You're lucky if that's the only place it sends notifications.

On Mac/iPhone it's built in. Somehow the phone isn't even part of this flow after initial setup, the SMSes go straight to the Mac.

Re: Passwordless: a different kind of hell?

#163

Post by bigstrat2003 »

jampekka wrote: post #5
asylteltine wrote: post #2

The reason this happens is because of bad actors. This is why we can’t have nice things. Walk around and pay attention next time and you will notice all the little things that are shitty because of bad actors like thieves.

Thieves and other "bad actors" are often a consequence of deeper underlying problems. People don't tend to steal that much when they are economically comfortable. OTOH with no legal resort to get sustinence, you're guaranteed to get people to resort to illegal means. I'm rather baffled how educated adult human beings keep on analyzing the world using moralistic fairytale level concepts like "bad actors" or "evildoers…

Both things can be (and are) true. There are deeper underlying problems which give thieves incentives to steal. Thieves are also acting badly (thus, are bad actors) when they steal.

Re: Passwordless: a different kind of hell?

#164

Post by jampekka »

Levitz wrote: post #158
jampekka wrote: post #5

Earlier quoted context omitted.

Thieves and other "bad actors" are often a consequence of deeper underlying problems. People don't tend to steal that much when they are economically comfortable. OTOH with no legal resort to get sustinence, you're guaranteed to get people to resort to illegal means. I'm rather baffled how educated adult human beings keep on analyzing the world using moralistic fairytale level concepts like "bad actors" or "evildoers…

>Thieves and other "bad actors" are often a consequence of deeper underlying problems. People don't tend to steal that much when they are economically comfortable. As time goes on I believe this less and less. I don't even think it's supported by the data. Spain or Sweden have way more thefts per capita than, say, Poland. Am I to believe a poor person is better of in Poland than in Spain or Sweden? They literally fre…

I'm from Helsinki and very much think it's safe because of relative lack of poverty, equality, relatively good opportunities regardless of background and social safety net that can be mostly trusted on. The social cohesion is the product of this.

We aren't some master race with pure souls. Finland was a shithole until about after WW2 after which the society was deliberately built to not be a shithole.

Re: Passwordless: a different kind of hell?

#165

Post by massysett »

PurpleRamen wrote: post #121
Al-Khwarizmi wrote: post #13

We are going way over the top with 2FA. Why do I need to activate mandatory 2FA in services like GitHub repositories for hobby projects? It's a lot of extra effort for a questionable security improvement, and anyway, if someone impersonates me there, it's not the end of the world. If they care about end users (which my projects mostly don't even have) mark me as "unverified" or something, but let me avoid the hassle.…

> Why do I need to activate mandatory 2FA in services like GitHub repositories for hobby projects? Because your hobby-project can emerge to be the backbone of someone's multibillion dollar-business, or a small gear in a million other projects, and you will get targeted for a supply-chain-attack.

You are right. However this cost should really be imposed on the multi-billion-dollar business and not on the author of the hobby app.

Re: Passwordless: a different kind of hell?

#166

Post by winphone1974 »

cogogo wrote: post #17
michaelt wrote: post #7

I recently ordered something on ebay. Nothing expensive, just a £60 item, and delivered to an address I've ordered many things to in the past. First I had to log into ebay - no problem, got my password manager right here, as soon as I unlock my phone with my fingerprint. Now I'll just key in my 12 character, randomly generated password with mixed case letters, numbers and symbols. Then ebay decided they wanted to sen…

Apple pay when available is about as low friction as you can get. I know it isnt available to everyone but there should be some similar standard that is. Near seamless.

Only because you've standardized on their ecosystem and pre-given them all your data. This is not the future we were promised

Re: Passwordless: a different kind of hell?

#167

Post by hot_gril »

ThePowerOfFuet wrote: post #21
michaelt wrote: post #7

I recently ordered something on ebay. Nothing expensive, just a £60 item, and delivered to an address I've ordered many things to in the past. First I had to log into ebay - no problem, got my password manager right here, as soon as I unlock my phone with my fingerprint. Now I'll just key in my 12 character, randomly generated password with mixed case letters, numbers and symbols. Then ebay decided they wanted to sen…

Why would you submit yourself to using PayPal when you don't have to? Serious question.

Sometimes there's no choice, usually for international purchases. eBay used to also prefer PayPal somehow, idk how it is now. I know that some Etsy sellers are PayPal-only.

Re: Passwordless: a different kind of hell?

#168

Post by jodrellblank »

squigz wrote: post #136
cryptonym wrote: post #132

Earlier quoted context omitted.

We shouldn't have to work installing & maintaining an awkward flow with random software to make buying experience less miserable. This should be fixed by the seller in the first place, where it makes sense and can be fixed easily and reliably.

In this case, how is eBay responsible for how PayPal and a bank handles things when they hand it off?

eBay owns PayPal

https://www.cnet.com/tech/tech-industry/ebay-picks-up-paypal... - August 2002

Re: Passwordless: a different kind of hell?

#169

Post by hot_gril »

zamadatix wrote: post #60
pertique wrote: post #36

Earlier quoted context omitted.

If you use a password manager (which they say they do) it's much quicker to just save that info and automatically populate it. Doubly so considering the MFA hell they went through.

Too many sites have broken forms. Sure, you can have the card autofilled but maybe it doesn't trigger the autofill for the address or maybe that wasn't even loaded yet. Maybe you can just click there and have it auto-fill but they can be so broken it doesn't autofill completely or fills wrong. Some sites are smart enough to have a checkbox for "shipping address is the same as billing" and others aren't. When you use…

Yeah, CC autofill is nice but fails about 1/4 of the time. It doesn't include the security code either. A few sites will also have finicky inputs, like accepting spaces but rejecting the payment if you use them.

Still, PayPal is an absolute last resort for me.

Re: Passwordless: a different kind of hell?

#170

Post by nlawalker »

Al-Khwarizmi wrote: post #13

We are going way over the top with 2FA. Why do I need to activate mandatory 2FA in services like GitHub repositories for hobby projects? It's a lot of extra effort for a questionable security improvement, and anyway, if someone impersonates me there, it's not the end of the world. If they care about end users (which my projects mostly don't even have) mark me as "unverified" or something, but let me avoid the hassle.…

> Why do I need to activate mandatory 2FA in services like GitHub repositories for hobby projects?

Same reason Microsoft forces Windows updates so aggressively - because if some kind of security breach makes the news, even if it's clearly due to poor user choices (poor password choices and/or security; repeatedly opting out of critical security updates), it's always the vendor/service provider that looks bad.

Post reply on HN